Greetings everyone!
Now it's my turn to not be responsible and secured enough to have a virus which I can't remove myself. I would like to ask for help from the support on these forums which I heard that their help is very effective. :smile:
I tried to follow instructions as much as I could understand them.
I have access to a possible file that caused this infection, but I do not know if I should really upload it here.
I also have a picture from print screen function of what is exactly happening to my PC. Should I also upload it?
Here's the dds.txt:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.21.2
Run by kuziz at 1:11:00 on 2013-04-27
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.3550.905 [GMT 2:00]
.
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\atieclxx.exe
C:\windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
C:\Program Files\Samsung\Easy Support Center\SamoyedAgent.exe
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\system32\taskhost.exe
C:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\cmd.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://samsung.msn.com
uDefault_Page_URL = hxxp://samsung.msn.com
mStart Page = hxxp://samsung.msn.com
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ips\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: WinToFlash Suggestor: {FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD} - C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
uRun: [AMD] C:\Users\kuziz\AppData\Local\Temp\tmpC2E4.tmp.exe
mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
mRun: [Java Update] C:\Program Files\Java\setup.vbs
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
IE: {A52C66B3-D4A9-4d10-A67D-2BEF0A85AB3F} - {FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD} - C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: NameServer = 10.0.0.100
TCP: Interfaces\{54919D0A-0197-4C26-941E-D0B763D0BA6E} : DHCPNameServer = 10.0.0.100
TCP: Interfaces\{54919D0A-0197-4C26-941E-D0B763D0BA6E}\E4544594143505F445D2634344735303 : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{BF912F4B-C328-4ED1-9BB7-9DE457B5632B} : DHCPNameServer = 8.8.8.8
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll
x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 198.167.139.193 google.com
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\windows\System32\drivers\amd_sata.sys [2011-12-12 82048]
R0 amd_xata;amd_xata;C:\windows\System32\drivers\amd_xata.sys [2011-12-12 42624]
R0 amdkmpfd;AMD PCI Root Bus Lower Filter;C:\windows\System32\drivers\amdkmpfd.sys [2012-3-19 32896]
R0 SymDS;Symantec Data Store;C:\windows\System32\drivers\NISx64\1309010.00E\symds64.sys [2013-2-6 451192]
R0 SymEFA;Symantec Extended File Attributes;C:\windows\System32\drivers\NISx64\1309010.00E\symefa64.sys [2013-2-6 1129120]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-4-13 1390680]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\System32\drivers\NISx64\1309010.00E\ccsetx64.sys [2013-2-6 167072]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20130425.001\IDSviA64.sys [2013-4-26 513184]
R1 SABI;SAMSUNG Kernel Driver For Windows 7;C:\windows\System32\drivers\SABI.sys [2012-6-1 13824]
R1 SymIRON;Symantec Iron Driver;C:\windows\System32\drivers\NISx64\1309010.00E\ironx64.sys [2013-2-6 190072]
R1 SymNetS;Symantec Network Security WFP Driver;C:\windows\System32\drivers\NISx64\1309010.00E\symnets.sys [2013-2-6 405624]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2012-4-5 235520]
R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-3-9 107648]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-14 2466304]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe [2013-2-6 138272]
R3 amdhub30;AMD USB 3.0 Hub Driver;C:\windows\System32\drivers\amdhub30.sys [2012-3-7 103552]
R3 amdxhc;AMD USB 3.0 Host Controller Driver;C:\windows\System32\drivers\amdxhc.sys [2012-3-7 220288]
R3 AthBTPort;Atheros Virtual Bluetooth Class;C:\windows\System32\drivers\btath_flt.sys [2012-3-9 36480]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\windows\System32\drivers\AtihdW76.sys [2012-2-23 95760]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\windows\System32\drivers\btath_a2dp.sys [2012-3-9 340096]
R3 btath_avdt;Atheros Bluetooth AVDT Service;C:\windows\System32\drivers\btath_avdt.sys [2012-3-9 111232]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\windows\System32\drivers\btath_bus.sys [2012-3-9 30848]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\windows\System32\drivers\btath_hcrp.sys [2012-3-9 168064]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\windows\System32\drivers\btath_lwflt.sys [2012-3-9 68736]
R3 BTATH_RCP;Bluetooth AVRCP Device;C:\windows\System32\drivers\btath_rcp.sys [2012-3-9 281472]
R3 BtFilter;BtFilter;C:\windows\System32\drivers\btfilter.sys [2012-3-9 551552]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\System32\drivers\clwvd.sys [2012-2-16 31216]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\windows\System32\drivers\dtsoftbus01.sys [2012-12-31 283200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-12-30 138912]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-6-1 685160]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\windows\System32\drivers\tap0901t.sys [2012-12-31 31232]
R3 usbfilter;AMD USB Filter Driver;C:\windows\System32\drivers\usbfilter.sys [2012-6-1 56448]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-1 183560]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\windows\System32\drivers\rdpvideominiport.sys [2013-3-8 19456]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUVStor.sys [2012-6-1 314472]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2013-3-8 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2013-3-8 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
.
=============== Created Last 30 ================
.
2074-05-18 16:44:52 607296 ----a-w- C:\Program Files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll
2013-04-26 17:31:38 -------- d-----w- C:\Users\kuziz\AppData\Roaming\dclogs
2013-04-26 16:54:44 866720 ----a-w- C:\windows\SysWow64\npDeployJava1.dll
2013-04-26 16:54:44 788896 ----a-w- C:\windows\SysWow64\deployJava1.dll
2013-04-26 16:54:24 95648 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-26 15:07:36 -------- d-----w- C:\Minecraft
2013-04-25 21:23:29 -------- d-----w- C:\Stranded
2013-04-25 18:01:33 -------- d-----w- C:\Battlezone 2
2013-04-24 21:26:38 -------- d-----w- C:\Users\kuziz\AppData\Local\FalloutNV
2013-04-24 17:42:54 -------- d-----w- C:\Program Files (x86)\Fallout New Vegas
2013-04-24 13:29:10 -------- d-----w- C:\Users\kuziz\AppData\Local\JC2MP
2013-04-24 13:18:28 1656680 ----a-w- C:\windows\System32\drivers\ntfs.sys
2013-04-22 22:53:31 0 ----a-w- C:\windows\SysWow64\sho8031.tmp
2013-04-21 19:25:49 -------- d-----w- C:\Program Files (x86)\THPS3
2013-04-21 06:52:38 -------- d-----w- C:\Program Files (x86)\Colobot DEMO
2013-04-20 21:08:24 -------- d-----w- C:\Program Files (x86)\Tony Hawks Pro Skater HD
2013-04-20 01:36:27 0 ----a-w- C:\windows\SysWow64\shoDD1.tmp
2013-04-17 22:12:08 0 ----a-w- C:\windows\SysWow64\sho56EF.tmp
2013-04-14 07:21:57 0 ----a-w- C:\windows\SysWow64\sho5787.tmp
2013-04-13 17:07:35 -------- d-----w- C:\Program Files (x86)\2K Games
2013-04-13 15:07:59 2312704 ----a-w- C:\windows\System32\jscript9.dll
2013-04-13 14:37:19 -------- d-----w- C:\Program Files (x86)\Flawless Widescreen
2013-04-12 20:02:46 0 ----a-w- C:\windows\SysWow64\shoCFA4.tmp
2013-04-12 18:26:57 -------- d-----w- C:\Program Files (x86)\Colobot
2013-04-12 18:00:59 -------- d-----w- C:\Users\kuziz\colobot
2013-04-12 17:45:04 466456 ----a-w- C:\windows\System32\wrap_oal.dll
2013-04-12 17:45:04 444952 ----a-w- C:\windows\SysWow64\wrap_oal.dll
2013-04-12 17:45:04 122904 ----a-w- C:\windows\System32\OpenAL32.dll
2013-04-12 17:45:04 109080 ----a-w- C:\windows\SysWow64\OpenAL32.dll
2013-04-12 17:45:04 -------- d-----w- C:\Program Files (x86)\OpenAL
2013-04-11 18:15:06 -------- d-----w- C:\Users\kuziz\AppData\Local\{FF3948E3-8E47-480F-B10C-5A76DB086BD0}
2013-04-11 15:35:31 -------- d-----w- C:\Program Files (x86)\Duke Nukem - Manhattan Project
2013-04-11 15:35:30 -------- d-----w- C:\Shortcuts
2013-04-10 19:07:42 0 ----a-w- C:\windows\SysWow64\sho934E.tmp
2013-04-10 14:58:16 -------- d-----w- C:\Program Files\AutoHotkey
2013-04-10 14:47:24 3153408 ----a-w- C:\windows\System32\win32k.sys
2013-04-10 14:47:06 223752 ----a-w- C:\windows\System32\drivers\fvevol.sys
2013-04-10 14:47:03 5550424 ----a-w- C:\windows\System32\ntoskrnl.exe
2013-04-10 14:47:02 3968856 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 14:47:02 3913560 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2013-04-10 14:47:02 112640 ----a-w- C:\windows\System32\smss.exe
2013-04-10 14:47:01 6656 ----a-w- C:\windows\SysWow64\apisetschema.dll
2013-04-10 14:47:01 43520 ----a-w- C:\windows\System32\csrsrv.dll
2013-04-09 16:07:05 -------- d-----w- C:\Quake2
2013-04-09 16:05:30 306688 ----a-w- C:\windows\IsUninst.exe
2013-04-09 07:01:00 0 ----a-w- C:\windows\SysWow64\shoD0D8.tmp
2013-04-07 04:54:09 0 ----a-w- C:\windows\SysWow64\shoD4FA.tmp
2013-04-06 03:56:34 -------- d-----w- C:\Program Files (x86)\Age of Empires II HD
2013-04-05 22:48:52 33240 ----a-w- C:\windows\System32\drivers\GEARAspiWDM.sys
2013-04-05 22:47:48 -------- d-----w- C:\Program Files\iPod
2013-04-05 22:47:47 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-05 22:47:47 -------- d-----w- C:\Program Files\iTunes
2013-04-05 22:47:47 -------- d-----w- C:\Program Files (x86)\iTunes
2013-04-05 22:38:41 -------- d-----w- C:\Users\kuziz\AppData\Local\Apple Computer
2013-04-05 22:37:31 -------- d-----w- C:\ProgramData\{35733029-9859-49C7-8475-1E78E2AAE413}
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin7.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin6.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin5.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin4.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin3.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin2.dll
2013-04-05 22:35:44 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin.dll
2013-04-05 22:34:58 -------- d-----w- C:\Users\kuziz\AppData\Local\Apple
2013-04-05 22:26:08 -------- d-----w- C:\Users\kuziz\AppData\Roaming\iFunbox_UserCache
2013-04-05 17:09:33 -------- d-----w- C:\Program Files (x86)\Microsoft Chart Controls
2013-04-04 18:28:24 -------- d-----w- C:\RO2Server
2013-04-03 15:17:33 -------- d-----w- C:\Users\kuziz\AppData\Local\Warframe
2013-04-02 02:51:38 -------- d-----w- C:\Program Files (x86)\Postal 2 Share The Pain
2013-03-31 19:46:08 -------- d-----w- C:\ProgramData\221040
2013-03-31 13:24:15 -------- d-----w- C:\ProgramData\Steam
2013-03-31 02:23:17 0 ----a-w- C:\windows\SysWow64\shoECEB.tmp
2013-03-30 04:03:16 0 ----a-w- C:\windows\SysWow64\shoC5AD.tmp
2013-03-28 21:33:37 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
.
==================== Find3M ====================
.
2013-04-21 14:42:49 107832 ----a-w- C:\windows\SysWow64\PnkBstrB.ex0
2013-04-13 21:35:39 215128 ----a-w- C:\windows\SysWow64\PnkBstrB.xtr
2013-03-24 15:45:26 2337865 ----a-w- C:\windows\SysWow64\pbsvc.exe
2013-03-08 14:08:46 314016 ----a-w- C:\windows\System32\drivers\atksgt.sys
2013-03-08 14:08:43 43680 ----a-w- C:\windows\System32\drivers\lirsgt.sys
2013-02-22 06:20:51 1392128 ----a-w- C:\windows\System32\wininet.dll
2013-02-22 06:19:37 1494528 ----a-w- C:\windows\System32\inetcpl.cpl
2013-02-22 06:15:48 173056 ----a-w- C:\windows\System32\ieUnatt.exe
2013-02-22 06:15:23 599040 ----a-w- C:\windows\System32\vbscript.dll
2013-02-22 06:12:41 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2013-02-22 03:46:00 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll
2013-02-22 03:38:00 1129472 ----a-w- C:\windows\SysWow64\wininet.dll
2013-02-22 03:37:50 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2013-02-22 03:34:17 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe
2013-02-22 03:34:03 420864 ----a-w- C:\windows\SysWow64\vbscript.dll
2013-02-22 03:31:46 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2013-02-19 15:28:45 71024 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-19 15:28:45 691568 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2013-02-15 21:44:24 8300544 ----a-w- C:\windows\SysWow64\DxtoryCodec.dll
2013-02-15 21:44:20 8043008 ----a-w- C:\windows\System32\DxtoryCodec.dll
2013-02-14 21:01:53 249856 ------w- C:\windows\Setup1.exe
2013-02-14 21:01:46 73216 ----a-w- C:\windows\ST6UNST.EXE
2013-02-14 17:21:34 94208 ----a-w- C:\windows\DIIUnin.exe
2013-02-14 17:21:34 2829 ----a-w- C:\windows\DIIUnin.pif
2013-02-14 16:54:50 21840 ----atw- C:\windows\SysWow64\SIntfNT.dll
2013-02-14 16:54:50 17212 ----atw- C:\windows\SysWow64\SIntf32.dll
2013-02-14 16:54:50 12067 ----atw- C:\windows\SysWow64\SIntf16.dll
2013-02-12 05:45:24 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45:22 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45:22 308736 ----a-w- C:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45:22 111104 ----a-w- C:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48:31 474112 ----a-w- C:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48:26 2176512 ----a-w- C:\windows\apppatch\AcGenral.dll
2013-02-12 04:12:05 19968 ----a-w- C:\windows\System32\drivers\usb8023.sys
2013-02-03 01:54:35 2434856 ----a-w- C:\windows\SysWow64\pbsvc_bc2.exe
.
============= FINISH: 1:12:11,07 ===============
Thanks for help.
Now it's my turn to not be responsible and secured enough to have a virus which I can't remove myself. I would like to ask for help from the support on these forums which I heard that their help is very effective. :smile:
I tried to follow instructions as much as I could understand them.
I have access to a possible file that caused this infection, but I do not know if I should really upload it here.
I also have a picture from print screen function of what is exactly happening to my PC. Should I also upload it?
Here's the dds.txt:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.21.2
Run by kuziz at 1:11:00 on 2013-04-27
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.3550.905 [GMT 2:00]
.
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k GPSvcGroup
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\atieclxx.exe
C:\windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
C:\Program Files\Samsung\Easy Support Center\SamoyedAgent.exe
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\system32\taskhost.exe
C:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\cmd.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://samsung.msn.com
uDefault_Page_URL = hxxp://samsung.msn.com
mStart Page = hxxp://samsung.msn.com
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ips\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: WinToFlash Suggestor: {FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD} - C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
uRun: [AMD] C:\Users\kuziz\AppData\Local\Temp\tmpC2E4.tmp.exe
mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
mRun: [Java Update] C:\Program Files\Java\setup.vbs
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
IE: {A52C66B3-D4A9-4d10-A67D-2BEF0A85AB3F} - {FC36B0BD-27F0-4cdd-8AB1-50651EFC3EFD} - C:\Program Files (x86)\WinToFlash Suggestor\WinToFlashSuggestor.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: NameServer = 10.0.0.100
TCP: Interfaces\{54919D0A-0197-4C26-941E-D0B763D0BA6E} : DHCPNameServer = 10.0.0.100
TCP: Interfaces\{54919D0A-0197-4C26-941E-D0B763D0BA6E}\E4544594143505F445D2634344735303 : DHCPNameServer = 192.168.1.254
TCP: Interfaces\{BF912F4B-C328-4ED1-9BB7-9DE457B5632B} : DHCPNameServer = 8.8.8.8
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll
x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 198.167.139.193 google.com
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
Hosts: 198.167.139.193 Google
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\windows\System32\drivers\amd_sata.sys [2011-12-12 82048]
R0 amd_xata;amd_xata;C:\windows\System32\drivers\amd_xata.sys [2011-12-12 42624]
R0 amdkmpfd;AMD PCI Root Bus Lower Filter;C:\windows\System32\drivers\amdkmpfd.sys [2012-3-19 32896]
R0 SymDS;Symantec Data Store;C:\windows\System32\drivers\NISx64\1309010.00E\symds64.sys [2013-2-6 451192]
R0 SymEFA;Symantec Extended File Attributes;C:\windows\System32\drivers\NISx64\1309010.00E\symefa64.sys [2013-2-6 1129120]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [2013-4-13 1390680]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\System32\drivers\NISx64\1309010.00E\ccsetx64.sys [2013-2-6 167072]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20130425.001\IDSviA64.sys [2013-4-26 513184]
R1 SABI;SAMSUNG Kernel Driver For Windows 7;C:\windows\System32\drivers\SABI.sys [2012-6-1 13824]
R1 SymIRON;Symantec Iron Driver;C:\windows\System32\drivers\NISx64\1309010.00E\ironx64.sys [2013-2-6 190072]
R1 SymNetS;Symantec Network Security WFP Driver;C:\windows\System32\drivers\NISx64\1309010.00E\symnets.sys [2013-2-6 405624]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2012-4-5 235520]
R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-3-9 107648]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-14 2466304]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccsvchst.exe [2013-2-6 138272]
R3 amdhub30;AMD USB 3.0 Hub Driver;C:\windows\System32\drivers\amdhub30.sys [2012-3-7 103552]
R3 amdxhc;AMD USB 3.0 Host Controller Driver;C:\windows\System32\drivers\amdxhc.sys [2012-3-7 220288]
R3 AthBTPort;Atheros Virtual Bluetooth Class;C:\windows\System32\drivers\btath_flt.sys [2012-3-9 36480]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\windows\System32\drivers\AtihdW76.sys [2012-2-23 95760]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\windows\System32\drivers\btath_a2dp.sys [2012-3-9 340096]
R3 btath_avdt;Atheros Bluetooth AVDT Service;C:\windows\System32\drivers\btath_avdt.sys [2012-3-9 111232]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\windows\System32\drivers\btath_bus.sys [2012-3-9 30848]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\windows\System32\drivers\btath_hcrp.sys [2012-3-9 168064]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\windows\System32\drivers\btath_lwflt.sys [2012-3-9 68736]
R3 BTATH_RCP;Bluetooth AVRCP Device;C:\windows\System32\drivers\btath_rcp.sys [2012-3-9 281472]
R3 BtFilter;BtFilter;C:\windows\System32\drivers\btfilter.sys [2012-3-9 551552]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\windows\System32\drivers\clwvd.sys [2012-2-16 31216]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\windows\System32\drivers\dtsoftbus01.sys [2012-12-31 283200]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-12-30 138912]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-6-1 685160]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\windows\System32\drivers\tap0901t.sys [2012-12-31 31232]
R3 usbfilter;AMD USB Filter Driver;C:\windows\System32\drivers\usbfilter.sys [2012-6-1 56448]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-1 183560]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\windows\System32\drivers\rdpvideominiport.sys [2013-3-8 19456]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUVStor.sys [2012-6-1 314472]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2013-3-8 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2013-3-8 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
.
=============== Created Last 30 ================
.
2074-05-18 16:44:52 607296 ----a-w- C:\Program Files (x86)\Microsoft Games\Age of Empires III\deformerdllyD.dll
2013-04-26 17:31:38 -------- d-----w- C:\Users\kuziz\AppData\Roaming\dclogs
2013-04-26 16:54:44 866720 ----a-w- C:\windows\SysWow64\npDeployJava1.dll
2013-04-26 16:54:44 788896 ----a-w- C:\windows\SysWow64\deployJava1.dll
2013-04-26 16:54:24 95648 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-26 15:07:36 -------- d-----w- C:\Minecraft
2013-04-25 21:23:29 -------- d-----w- C:\Stranded
2013-04-25 18:01:33 -------- d-----w- C:\Battlezone 2
2013-04-24 21:26:38 -------- d-----w- C:\Users\kuziz\AppData\Local\FalloutNV
2013-04-24 17:42:54 -------- d-----w- C:\Program Files (x86)\Fallout New Vegas
2013-04-24 13:29:10 -------- d-----w- C:\Users\kuziz\AppData\Local\JC2MP
2013-04-24 13:18:28 1656680 ----a-w- C:\windows\System32\drivers\ntfs.sys
2013-04-22 22:53:31 0 ----a-w- C:\windows\SysWow64\sho8031.tmp
2013-04-21 19:25:49 -------- d-----w- C:\Program Files (x86)\THPS3
2013-04-21 06:52:38 -------- d-----w- C:\Program Files (x86)\Colobot DEMO
2013-04-20 21:08:24 -------- d-----w- C:\Program Files (x86)\Tony Hawks Pro Skater HD
2013-04-20 01:36:27 0 ----a-w- C:\windows\SysWow64\shoDD1.tmp
2013-04-17 22:12:08 0 ----a-w- C:\windows\SysWow64\sho56EF.tmp
2013-04-14 07:21:57 0 ----a-w- C:\windows\SysWow64\sho5787.tmp
2013-04-13 17:07:35 -------- d-----w- C:\Program Files (x86)\2K Games
2013-04-13 15:07:59 2312704 ----a-w- C:\windows\System32\jscript9.dll
2013-04-13 14:37:19 -------- d-----w- C:\Program Files (x86)\Flawless Widescreen
2013-04-12 20:02:46 0 ----a-w- C:\windows\SysWow64\shoCFA4.tmp
2013-04-12 18:26:57 -------- d-----w- C:\Program Files (x86)\Colobot
2013-04-12 18:00:59 -------- d-----w- C:\Users\kuziz\colobot
2013-04-12 17:45:04 466456 ----a-w- C:\windows\System32\wrap_oal.dll
2013-04-12 17:45:04 444952 ----a-w- C:\windows\SysWow64\wrap_oal.dll
2013-04-12 17:45:04 122904 ----a-w- C:\windows\System32\OpenAL32.dll
2013-04-12 17:45:04 109080 ----a-w- C:\windows\SysWow64\OpenAL32.dll
2013-04-12 17:45:04 -------- d-----w- C:\Program Files (x86)\OpenAL
2013-04-11 18:15:06 -------- d-----w- C:\Users\kuziz\AppData\Local\{FF3948E3-8E47-480F-B10C-5A76DB086BD0}
2013-04-11 15:35:31 -------- d-----w- C:\Program Files (x86)\Duke Nukem - Manhattan Project
2013-04-11 15:35:30 -------- d-----w- C:\Shortcuts
2013-04-10 19:07:42 0 ----a-w- C:\windows\SysWow64\sho934E.tmp
2013-04-10 14:58:16 -------- d-----w- C:\Program Files\AutoHotkey
2013-04-10 14:47:24 3153408 ----a-w- C:\windows\System32\win32k.sys
2013-04-10 14:47:06 223752 ----a-w- C:\windows\System32\drivers\fvevol.sys
2013-04-10 14:47:03 5550424 ----a-w- C:\windows\System32\ntoskrnl.exe
2013-04-10 14:47:02 3968856 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 14:47:02 3913560 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2013-04-10 14:47:02 112640 ----a-w- C:\windows\System32\smss.exe
2013-04-10 14:47:01 6656 ----a-w- C:\windows\SysWow64\apisetschema.dll
2013-04-10 14:47:01 43520 ----a-w- C:\windows\System32\csrsrv.dll
2013-04-09 16:07:05 -------- d-----w- C:\Quake2
2013-04-09 16:05:30 306688 ----a-w- C:\windows\IsUninst.exe
2013-04-09 07:01:00 0 ----a-w- C:\windows\SysWow64\shoD0D8.tmp
2013-04-07 04:54:09 0 ----a-w- C:\windows\SysWow64\shoD4FA.tmp
2013-04-06 03:56:34 -------- d-----w- C:\Program Files (x86)\Age of Empires II HD
2013-04-05 22:48:52 33240 ----a-w- C:\windows\System32\drivers\GEARAspiWDM.sys
2013-04-05 22:47:48 -------- d-----w- C:\Program Files\iPod
2013-04-05 22:47:47 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-05 22:47:47 -------- d-----w- C:\Program Files\iTunes
2013-04-05 22:47:47 -------- d-----w- C:\Program Files (x86)\iTunes
2013-04-05 22:38:41 -------- d-----w- C:\Users\kuziz\AppData\Local\Apple Computer
2013-04-05 22:37:31 -------- d-----w- C:\ProgramData\{35733029-9859-49C7-8475-1E78E2AAE413}
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin7.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin6.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin5.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin4.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin3.dll
2013-04-05 22:35:45 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin2.dll
2013-04-05 22:35:44 143360 ----a-w- C:\Program Files (x86)\Internet Explorer\Wtyczki\npqtplugin.dll
2013-04-05 22:34:58 -------- d-----w- C:\Users\kuziz\AppData\Local\Apple
2013-04-05 22:26:08 -------- d-----w- C:\Users\kuziz\AppData\Roaming\iFunbox_UserCache
2013-04-05 17:09:33 -------- d-----w- C:\Program Files (x86)\Microsoft Chart Controls
2013-04-04 18:28:24 -------- d-----w- C:\RO2Server
2013-04-03 15:17:33 -------- d-----w- C:\Users\kuziz\AppData\Local\Warframe
2013-04-02 02:51:38 -------- d-----w- C:\Program Files (x86)\Postal 2 Share The Pain
2013-03-31 19:46:08 -------- d-----w- C:\ProgramData\221040
2013-03-31 13:24:15 -------- d-----w- C:\ProgramData\Steam
2013-03-31 02:23:17 0 ----a-w- C:\windows\SysWow64\shoECEB.tmp
2013-03-30 04:03:16 0 ----a-w- C:\windows\SysWow64\shoC5AD.tmp
2013-03-28 21:33:37 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
.
==================== Find3M ====================
.
2013-04-21 14:42:49 107832 ----a-w- C:\windows\SysWow64\PnkBstrB.ex0
2013-04-13 21:35:39 215128 ----a-w- C:\windows\SysWow64\PnkBstrB.xtr
2013-03-24 15:45:26 2337865 ----a-w- C:\windows\SysWow64\pbsvc.exe
2013-03-08 14:08:46 314016 ----a-w- C:\windows\System32\drivers\atksgt.sys
2013-03-08 14:08:43 43680 ----a-w- C:\windows\System32\drivers\lirsgt.sys
2013-02-22 06:20:51 1392128 ----a-w- C:\windows\System32\wininet.dll
2013-02-22 06:19:37 1494528 ----a-w- C:\windows\System32\inetcpl.cpl
2013-02-22 06:15:48 173056 ----a-w- C:\windows\System32\ieUnatt.exe
2013-02-22 06:15:23 599040 ----a-w- C:\windows\System32\vbscript.dll
2013-02-22 06:12:41 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2013-02-22 03:46:00 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll
2013-02-22 03:38:00 1129472 ----a-w- C:\windows\SysWow64\wininet.dll
2013-02-22 03:37:50 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2013-02-22 03:34:17 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe
2013-02-22 03:34:03 420864 ----a-w- C:\windows\SysWow64\vbscript.dll
2013-02-22 03:31:46 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
2013-02-19 15:28:45 71024 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-19 15:28:45 691568 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2013-02-15 21:44:24 8300544 ----a-w- C:\windows\SysWow64\DxtoryCodec.dll
2013-02-15 21:44:20 8043008 ----a-w- C:\windows\System32\DxtoryCodec.dll
2013-02-14 21:01:53 249856 ------w- C:\windows\Setup1.exe
2013-02-14 21:01:46 73216 ----a-w- C:\windows\ST6UNST.EXE
2013-02-14 17:21:34 94208 ----a-w- C:\windows\DIIUnin.exe
2013-02-14 17:21:34 2829 ----a-w- C:\windows\DIIUnin.pif
2013-02-14 16:54:50 21840 ----atw- C:\windows\SysWow64\SIntfNT.dll
2013-02-14 16:54:50 17212 ----atw- C:\windows\SysWow64\SIntf32.dll
2013-02-14 16:54:50 12067 ----atw- C:\windows\SysWow64\SIntf16.dll
2013-02-12 05:45:24 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-02-12 05:45:22 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll
2013-02-12 05:45:22 308736 ----a-w- C:\windows\apppatch\AppPatch64\AcGenral.dll
2013-02-12 05:45:22 111104 ----a-w- C:\windows\apppatch\AppPatch64\acspecfc.dll
2013-02-12 04:48:31 474112 ----a-w- C:\windows\apppatch\AcSpecfc.dll
2013-02-12 04:48:26 2176512 ----a-w- C:\windows\apppatch\AcGenral.dll
2013-02-12 04:12:05 19968 ----a-w- C:\windows\System32\drivers\usb8023.sys
2013-02-03 01:54:35 2434856 ----a-w- C:\windows\SysWow64\pbsvc_bc2.exe
.
============= FINISH: 1:12:11,07 ===============
Thanks for help.